Sciweavers

ACSAC
2004
IEEE

Detecting Exploit Code Execution in Loadable Kernel Modules

14 years 3 months ago
Detecting Exploit Code Execution in Loadable Kernel Modules
In current extensible monolithic operating systems, loadable kernel modules (LKM) have unrestricted access to all portions of kernel memory and I/O space. As a result, kernel-module exploitation can jeopardize the integrity of the entire system. In this paper, we analyze the threat that comes from the implicit trust relationship between the operating system kernel and loadable kernel modules. We then present a specification-directed access monitoring tool-HECK, that detects kernel modules for malicious code execution. Inside the module, HECK prevents code execution on the kernel stack and the data sections; on the boundary, HECK restricts the module's access to only those kernel resources necessary for the module's operation. Our measurements show that our tool incurs 5
Haizhi Xu, Wenliang Du, Steve J. Chapin
Added 20 Aug 2010
Updated 20 Aug 2010
Type Conference
Year 2004
Where ACSAC
Authors Haizhi Xu, Wenliang Du, Steve J. Chapin
Comments (0)